Please report security issues privately — do not open a public issue.

• Preferred: GitHub's private vulnerability reporting on this repository (Security → Report a vulnerability).
• Or email oss@driverforge.com.

Please include a description, reproduction steps, and the affected version where you can. We'll acknowledge your report and keep you posted on the fix.

This policy covers the Driverforge GitHub Action in this repository — the composite action that installs the driverforge CLI onto a CI runner and optionally runs it. The action ships no credentials of its own: it downloads a pinned, checksum-verified driverforge release from Driverforge's public release storage and puts it on PATH. The driverforge CLI itself, the Anvil backend/ingestion, and the agent are separate and out of scope here.

We support the latest released v1 of the action — please confirm the issue on the current release before reporting.